mcp-gate: extract voi.rs into a leaf crate — a security gate should not link bundled SQLite

Found during the WP33 audit (#919).

The problem

mcp-gate now depends on ruvector-tiny-dancer-core solely to reuse the value-of-information primitive. That single edge pulls 42 crates into the gate's dependency closure, taking its total to 117 — including bundled SQLite (rusqlite + libsqlite3-sys), safetensors, ndarray, redb, memmap2, and rayon.

What is actually used is six pure-math items from voi.rs: decide, observe, voi_upper_bound, Belief, EstimatorSpec, VoiConfig. No state, no I/O, no allocation beyond a Vec.

Why this is not a style complaint

mcp-gate is a security gate. Its job is to be small and auditable. Linking a C compilation unit (bundled SQLite) and a tensor stack into the component that decides whether an operation is allowed:

• enlarges the build-time supply-chain surface of precisely the component that should have the smallest one,
• enlarges the binary and the audit scope,
• and couples the gate's release cadence to an ML routing crate it shares nothing else with.

Note the workspace does not gain a new compilation — these crates already build for other members — so this is about the gate's own closure, not total build time.

Suggested fix

Extract voi.rs into a leaf crate — ruvector-voi — depending on nothing but std (it is pure math: a normal CDF, a Gaussian expected-improvement integral, and a greedy index policy). Have both ruvector-tiny-dancer-core and mcp-gate depend on that.

A default-off feature on tiny-dancer-core gating everything except voi.rs would also work and is less disruptive, but a leaf crate is cleaner given voi.rs is explicitly designed for reuse — its own module docs name model selection, retrieval depth, verifier invocations, agent spawning, and escalation as intended call sites, so more consumers are expected.

Scope

Not a correctness issue and not a blocker for #919 — the VoI code itself audited clean (formula equivalence verified to sub-ulp, non-finite rejection at the choke point, escalate-only proven structurally in Wave 4). This is about where it lives.

Worth doing before the monitoring ladder is wired into the gate's actual request path, which per the audit it currently is not.

Start with voi.rs and trace how its six public items are consumed by ruvector-tiny-dancer-core and mcp-gate. Review the workspace dependency declarations and verify that both consumers use a std-only leaf crate while mcp-gate no longer pulls bundled SQLite or the unrelated dependency stack. Run the affected workspace tests and inspect the gate's dependency closure to confirm the reduced boundary.